ASDL speed has suddenly halved since this weekend

[#1]

I do a lot of syncing with an FTP server so generally keep track of what download speed I get. For over a year I've been consistently getting speeds between 800-1000 KB/s. However, since this weekend, the maximum I've seen is 500 KB/s with it usually hovering around the 150-350 range. I was hoping this was temporary due to something going on at my exchange but it's now still an issue two days later. Hoping it's not my router but at the moment I can't rule that out as I'm having other issues with it.
Posting stats in the hope that someone might be able to shed some light on the issue. Router currently connected via Openreach ADSL faceplate filter/splitter.
Router stats
Uptime: 1 day, 10:22:36
DSL Type: ITU-T G.992.5
Bandwidth (Up/Down) [kbps/kbps]: 1,147 / 10,207
Data Transferred (Sent/Received) [MB/GB]: 923.88 / 17.74
Output Power (Up/Down) [dBm]: 12.3 / 0.0
Line Attenuation (Up/Down) [dB]: 19.0 / 34.5
SN Margin (Up/Down) [dB]: 5.9 / 11.9
System Vendor ID (Local/Remote): TMMB / ----
Chipset Vendor ID (Local/Remote): BDCM / IFTN
Loss of Framing (Local/Remote): 0 / 0
Loss of Signal (Local/Remote): 0 / 0
Loss of Power (Local/Remote): 0 / 0
Loss of Link (Remote): -
Error Seconds (Local/Remote): 1,380 / 3
FEC Errors (Up/Down): 0 / 0
CRC Errors (Up/Down): 146 / 2,180
HEC Errors (Up/Down): 123 / 6,548
Speedtest

Line speed
Phone exchange: DEPTFORD
Estimated line speed: 12Mb (This may vary between 11Mb and 14.5Mb) - Checked on 2014-12-21 14:28:48
Current line speed: 9 Mb

[#2]

Apart from the fact that DLM has obviously been unhappy with your line at some point and has raised the DS Target SNRM to 12dB by the looks of it, this would account for your speed being below the estimated, the error rate seems a bit higher than one would like to see, but not overly so.
Can you describe any internal wiring and extension socket arrangements?
In future should you need to do anything that involves loss of sync, ie a reboot, or change sockets, filters etc, then you would be best adopting the graceful Disconnection method -
Log in to the Modem/Router, in the Internet box, click Disconnect to drop the PPP Internet session (this is not the sync), wait about a minute and then power down the Modem/Router. After about another minute you can unplug it from the line.
Do whatever is needed, but stay offline for at least 10 minutes. When you re-connect and power up, Login to the Modem/Router and click Connect to establish a new PPP session if needed.
Don't do this more than 5 times in an hour, then leave it for the rest of the day. This method is to help stop the Exchange DLM from thinking your sync loss was a dropped connection.
(If you have a modem/router that doesn't have an interface for you to drop the PPP session, then pull the power plug and wait a minute or two before unplugging from the line.)
One further point, especially applicable to longer lines, you will get very small differences in sync speed every time you sync, so just because you get a marginally better sync speed in one situation, it doesn't necessarily mean that situation is better than another situation. It's also generally better to sync in daylight hours as noise levels are usually lower.
Your sync speed and current errors don't however account for the quite low throughput speed you are seeing which ought to be around double. It's possible that this might be due to congestion somewhere.
You need to run some speedtests at peak and off-peak times to see if there is any significant difference. You should also do these using an ethernet connection to rule out any wireless issues.
If things seem worse at peak times, you could try a Gateway hop to see if it's Gateway related.
You can check which Gateway you are on and you can then do a Disconnect & Connect (without a power down) to Gateway hop. Confirm which Gateway you are on after the hop.

[#3]

Could this be the cause of this - http://community.plus.net/forum/index.php/topic,136815.msg1201231.html#msg1201231 ?

[#4]

As it's not clear if "Web Browsing Interception" was bbgmp's issue, I didn't get that impression from the OP on that thread, then the answer is possibly not.
But it will certainly helpful if bbgmp could clarify if he's had the Login page popping up unexpectedly.

[#5]

AO,
Unless I have totally lost the plot, bbgmp was the OP on that thread...
I believe browser intercept is the default setting on the routers.
Kevin

[#6]

Kevin please read the OP in that thread, bbgmp does not give the impression that the Login page was popping up unexpectedly then or later, although that certainly seems to be the case with at least one of the subsequent posters there.
Where has anyone questioned the default setting?

[#7]

Definitely something dodgy going on here.
~2000 CRC errors in the space of 34 hours, while always disconcerting to see, shouldn't be anywhere near high enough to cause you to lose sync OR cripple your throughput, unless your line is marginal in other ways also. I run at anywhere between 120-200 per hour, which is closer to 4000-5000 in a 24 hour period, and still get close to my IP profile in throughput.
To be completely honest, this, coupled with your admin UI issues, leads me to think the problem may be malware/rootkit related rather than a service disruption. It might be worth monitoring the data transferred stats on the router after a reset without actually USING the internet for an hour or so, and see if any major traffic is passing through without your interaction.
Failing that, it could be an issue with congestion, but I'd always recommend trying a different router before fearing the worst. It's almost too much of a coincidence that they both started occurring at the same time to ignore the correlation, so your likeliest scenarios are an issue with your PC, or the router.

[#8]

From our side, very basic checks appear to be OK. Your connection is stable, and I'd expect one of the problems mentioned only to occur if you were dropping ppp or sync.
Errors on the line are quite frequent, but these may not be service affecting.

[#9]

Thanks for that Tony.
@mdc
Checking for malware is certainly a good idea, but I wouldn't consider trying a different modem/router at this stage with out checking out all the other things previously suggested.
@bbgmp
Is your Plusnet Firewall (login needed) set to Low? If you are not using any of the ports listed I would may sure it's turned on to Low.
You could also try logging into the 582n and go to the >Techicolor Gateway >Events Log page and do a copy and paste of that here just to see if there's anything out of the ordinary (make sure All is selected in the drop-down box). This direct link http://192.168.1.254/cgi/b/events/?be=0&l0=1&l1=2 may work (depends on your firmware), you'll get the login screen on the way if not already logged in.

[#10]

Thanks to everyone for the responses so far! 

Quote from: Anotherone

Can you describe any internal wiring and extension socket arrangements?

No extension sockets. Router plugged straight into only socket in flat which is spit via Openreach faceplate:

Quote from: Anotherone

As it's not clear if "Web Browsing Interception" was bbgmp's issue, I didn't get that impression from the OP on that thread, then the answer is possibly not. But it will certainly helpful if bbgmp could clarify if he's had the Login page popping up unexpectedly.

To clarify: Having a random router login page while browsing isn't the issue. Only when I'm trying to access the router's web portal.

Quote from: mdc

To be completely honest, this, coupled with your admin UI issues, leads me to think the problem may be malware/rootkit related rather than a service disruption. It might be worth monitoring the data transferred stats on the router after a reset without actually USING the internet for an hour or so, and see if any major traffic is passing through without your interaction.

Was thinking that too actually though ran Malwarebytes Anti-Malware over the weekend so if there's something there, it's buried deep. Will do a reset and check the transferred stats.
Is there a way to monitor internet traffic across the whole network? Would be interested to see where traffic is being generated.

Quote from: mdc

It's almost too much of a coincidence that they both started occurring at the same time to ignore the correlation, so your likeliest scenarios are an issue with your PC, or the router.

Actually, the relogging issue has been ongoing for a while but it's something I've been living with. Eventually made the effort to make a forum post about it when I was trying to access the router to investigate the speed issue and got frustrated.

Quote from: Anotherone

Is your Plusnet Firewall (login needed) set to Low?

It's set to "standard" which seems to be the best option.

Copy/paste of events log.
Can guess what some of this means. Not sure why it's showing I logged in via telnet as only accessing via the browser.
Are the firewall errors anything to worry about? IP's seem to be from a random selection of countries.
Info Feb 17 20:36:30 LOGIN User admin logged in on TELNET (192.168.1.65)
Info Feb 17 20:36:29 LOGOUT User admin logged out on TELNET (192.168.1.65)
Info Feb 17 20:36:28 LOGIN User admin logged in on [HTTP] (from 192.168.1.65)
Info Feb 17 20:36:20 LOGIN User admin logged in on TELNET (192.168.1.65)
Info Feb 17 20:36:19 LOGOUT User admin logged out on TELNET (192.168.1.65)
Info Feb 17 20:32:32 LOGIN User admin logged in on TELNET (192.168.1.65)
Info Feb 17 20:32:29 LOGOUT User admin logged out on TELNET (192.168.1.65)
Info Feb 17 20:30:48 LOGIN User admin logged in on [HTTP] (from 192.168.1.65)
Info Feb 17 20:30:21 LOGIN User admin logged in on [HTTP] (from 192.168.1.65)
Info Feb 17 20:28:57 LOGIN User admin logged in on [HTTP] (from 192.168.1.65)
Info Feb 17 20:28:26 LOGIN User admin logged in on [HTTP] (from 192.168.1.65)
Info Feb 17 20:26:28 LOGIN User admin logged in on [HTTP] (from 192.168.1.65)
Info Feb 17 19:38:38 SNTP Synchronised to server: 212.159.13.49
Info Feb 17 18:38:38 SNTP Synchronised to server: 212.159.6.10
Info Feb 17 17:38:38 SNTP Synchronised to server: 212.159.13.49
Info Feb 17 16:38:38 SNTP Synchronised again to server: 212.159.6.10
Error Feb 17 15:52:19 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 59.175.38.131 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Info Feb 17 15:38:38 SNTP Synchronised again to server: 212.159.6.10
Error Feb 17 15:35:44 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 62.120.52.148 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Error Feb 17 15:26:44 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 220.208.243.135 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Error Feb 17 15:17:04 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 58.239.3.6 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Info Feb 17 14:38:38 SNTP Synchronised again to server: 212.159.6.10
Error Feb 17 14:30:50 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 61.99.87.213 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Error Feb 17 14:12:36 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 27.119.149.104 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Error Feb 17 13:49:28 FIREWALL icmp check (1 of 2): Protocol: ICMP Src ip: 36.46.37.234 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Error Feb 17 13:41:16 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 112.250.48.80 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Info Feb 17 13:38:38 SNTP Synchronised to server: 212.159.6.10
Error Feb 17 13:11:09 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 87.98.172.179 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable
Error Feb 17 13:08:59 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 187.18.32.130 Dst ip: 87.115.127.176 Type: Time Exceeded Code: Time to Live exceeded in Transit
Error Feb 17 13:01:57 FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: 113.77.34.193 Dst ip: 87.115.127.176 Type: Destination Unreachable Code: Port Unreacheable

[#11]

Update:
Last FTP sync had speeds back to normal. Speed test also shows improvement.

Seems whatever the problem was sorted itself out.
Thanks to everyone for taking the time to suggest fixes!